CVE-2026-93147: s390/bpf: Replace ly instruction with llgf
Published Sep 17, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
s390/bpf: Replace ly instruction with llgf
cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does.
Event History
Sep 17, 2026
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
Description
Frequently Asked Questions
1
Which systems are affected by this issue?
The issue is specific to the Linux kernel s390 BPF implementation. It concerns loading the 32-bit cpu_nr value into the 64-bit BPF_REG_0 register.
2
What condition causes the incorrect value?
The problem occurs when the ly instruction loads cpu_nr into BPF_REG_0 without clearing the register's upper 32 bits. The corrected llgf instruction zeroes those upper bits.
3
How can the issue be addressed?
Apply a kernel update containing the change that replaces ly with llgf in the s390 BPF code path. The provided stable-kernel references identify commits carrying that fix.